01 · IDENTITY & ARCHITECTURE
SOC ENGINEERSOC ANALYST L2
Less noise. Faster decisions. Stronger defence.
I’m Ashraf Gamal, a SOC Analyst L2 and Senior SOC Engineer in Riyadh. I build the SIEM and SOAR platforms security teams rely on, then investigate what they catch. From QRadar and Wazuh deployments to automated response workflows, my work is turning alert noise into clear, confident decisions.
This site is my working notebook: tested implementations, real troubleshooting, and how I validate that a setup actually works.
ROLE
SOC Analyst L2 & SOC Engineer
FOCUS
Detection & Response
STACK
QRadar / Wazuh / Splunk
AUTOMATION
n8n / APIs
SOAR
QRadar SOAR / DFIR-IRIS
BASE
Saudi Arabia
HOW I WORK
Two lanes, one loop.
I build the platform the SOC relies on, then work the alerts it produces. What I learn from one feeds the other.
SOC ENGINEER · BUILD
1
Onboard
Connect log sources and prove the events actually arrive.
2
Parse & normalize
Shape fields so rules and searches can rely on them.
3
Detect & tune
Write rules, map them to ATT&CK, cut false positives.
4
Automate
Schedule healthchecks, enrichment and reports.
SOC ANALYST L2 · INVESTIGATE
1
Triage
Validate the alert and separate signal from noise.
2
Investigate
Pivot across logs, hosts and threat intel to build the story.
3
Contain & escalate
Act within scope, or hand off with full context.
4
Document & feed back
Case notes, lessons and tuning requests back to engineering.
↻ Every investigation feeds the next detection.
02 · CORE EXPERTISE
Six disciplines behind a SOC that works.
⌘
SIEM Engineering
Log collection and parsing, custom rules, alert tuning, platform health, retention and performance troubleshooting.
⌕
Detection & Hunting
Detection logic, event analysis, hypothesis-driven hunting, false-positive reduction and MITRE ATT&CK mapping.
⤳
Security Integrations
API-driven integrations, alert normalization, case management, threat intelligence and reliable data flow.
⟲
SOAR & Automation
Incident workflows, enrichment, repeatable response, reporting and automation with APIs and n8n.
⌁
Incident Response
Alert triage, investigation workflows, evidence-aware analysis, case documentation and escalation context.
▤
Platform Operations
Linux and Docker operations, availability checks, storage management, cluster troubleshooting and health checks.
WazuhIBM QRadar SIEMIBM QRadar SOARSplunkMITRE ATT&CKSigmaYARASysmonWindows Event LogsDFIR-IRISOpenCTIMISP
WazuhIBM QRadar SIEMIBM QRadar SOARSplunkMITRE ATT&CKSigmaYARASysmonWindows Event LogsDFIR-IRISOpenCTIMISP
n8nPythonBashREST APIsLinuxDockerWindows ServerActive DirectoryOpenSearch / ElasticsearchKibanaHAProxySyslogOffice 365Google WorkspaceWiresharkCuckoo SandboxNmapNessusOpenVASBurp Suite
n8nPythonBashREST APIsLinuxDockerWindows ServerActive DirectoryOpenSearch / ElasticsearchKibanaHAProxySyslogOffice 365Google WorkspaceWiresharkCuckoo SandboxNmapNessusOpenVASBurp Suite
EXPERIENCE
Four years, six client engagements.
4+
years in SOC operations
6
client engagements delivered
14+
branches centralised in one Wazuh deployment
29
certifications & courses
01/2025 – PRESENT
SOC Analyst L2 / Senior SOC Engineer
Securenas · Riyadh, Saudi Arabia
Lead escalated L2/L3 investigations and incident response, build detections and threat hunts, deliver SIEM/SOAR platforms for clients, shape MDR services and mentor junior analysts.
IBM QRadarWazuhSplunkSOARThreat hunting09/2022 – 12/2024
SOC Analyst / Engineer
Securenas · Riyadh, Saudi Arabia
Monitored and triaged SIEM and EDR alerts, tuned rules, and built IBM SOAR playbooks and integrations to automate enrichment and response.
Alert triageRule tuningIBM SOAR07/2023 – 10/2023
BlueTeam Scholarship
CyberTalents · Remote
Defensive security scholarship alongside the day job.
Blue teamWHAT I FOCUS ON
Detection fidelity
Rules that earn their place, mapped to MITRE ATT&CK.
Less alert fatigue
Tuning and enrichment so analysts see what matters.
Faster response
Lower MTTR through playbooks and automation.
Stronger monitoring
Continuously improving visibility and response capability.
CLIENT ENGAGEMENTS
AVIATION
01/2026 – PRESENT
Incident Response Retainer
Incident Responder: triage, forensic investigation, evidence analysis, containment support and remediation recommendations.
Incident responseForensicsMULTI-BRANCH ENTERPRISE
05/2026 – PRESENT
Distributed Wazuh SIEM
Designed the architecture and centralised log collection from 14+ branches across Saudi Arabia, with hardening, tuning and health monitoring.
WazuhClusterDetection rulesGOVERNMENT OFFICE
12/2024 – PRESENT
QRadar SIEM & SOAR build
Platform setup, log-source onboarding, parsing, use cases, dashboards, plus SOAR workflows and playbooks for enrichment and response.
QRadar SIEMQRadar SOARGOVERNMENT DIRECTORATE
2024 – PRESENT
QRadar SIEM & SOAR build
Implemented SIEM and SOAR end to end, from onboarding and correlation to automated enrichment and investigation workflows.
QRadar SIEMQRadar SOARFINANCIAL INSTITUTION
03/2024 – 04/2026
SOC Analyst L2 & SIEM/SOAR admin
Advanced investigation and threat hunting, platform health checks, SOAR playbooks and ATT&CK-aligned detection improvement.
Threat huntingHealth checksSOARREGIONAL AUTHORITY
2024 – 08/2025
QRadar SIEM design, then L2 SOC
Designed and tuned the SIEM, onboarded multiple sources, then served as SOC Analyst L2 for escalated incidents.
QRadar SIEMTuningCREDENTIALS
Proof behind the work.
KEY CERTIFICATIONS
eCTHPv2 Threat HuntingeCIR Incident ResponderCertified in Cybersecurity (ISC)²IBM QRadar SIEM FoundationIBM Resilient SOAR FoundationsSplunk Security Operations & Defense AnalystCertified AppSec PractitionerCCNA v7Purple Teaming (CyberWarFare)
29 certifications and courses in total
ACHIEVEMENTS
Gold Medal, Network Track
Huawei ICT Competition 2020
Top 1% on TryHackMe
Active CTF player since 2022 (THM, LetsDefend, CyberTalents, BTL, CyberDefenders)
EDUCATION
B.Sc. Computer Science
Faculty of Computers and Information, Luxor University
2017 – 2021 · Excellent with first honor
03 · FIELD NOTES & TECHNICAL GUIDES
Field-tested notes.
24 notes from hands-on SIEM, SOAR, response and automation work.
24 notes · 24 total
Loading technical notes…
04 · CONNECT
Turn alert noise into decisions.
Got a security challenge, an opportunity to discuss, or need my CV? Let's talk.